Critical Remote Code Execution Flaw Discovered in Fanwei E-cology10 Enterprise Platform A severe security vulnerability (QVD-2026-14149) has been identified in Fanwei E-cology10 (E10), a widely used enterprise collaboration platform developed by Shanghai Fanwei Network Technology. The flaw, rated 9.8 (Critical) on the CVSS 3.1 scale, enables unauthenticated remote code execution (RCE), allowing attackers to take full control of vulnerable servers without requiring credentials or user interaction. The vulnerability stems from a command injection weakness in a specific E-cology10 server interface. By sending a maliciously crafted request, attackers can execute arbitrary commands with elevated privileges, potentially compromising sensitive business data, session tokens, and internal workflows. Given the platform’s role as a digital hub for collaborative office work, process management, and low-code development, exploitation could grant attackers persistent access to corporate environments while evading detection. Security researchers at QiAnXin Threat Intelligence Center disclosed the flaw on March 17, 2026, following its initial publication on March 12, 2026. While no public proof-of-concept exploit has been confirmed, QiAnXin demonstrated the vulnerability internally, warning of its high exploitability due to its low attack complexity and network-based attack vector. Affected versions include E-cology 10.0 with security patch versions below v20260312. Weaver, the vendor, has released an official patch (v20260312 or later), urging organizations to apply the update immediately. Security teams are advised to monitor server logs for unusual activity on the vulnerable interface and update detection rules to identify potential exploitation attempts.